On January 10, 2023, the next, sixth edition of the draft act on the protection of persons reporting violations, i.e. the so-called Whistleblower Act. Although the next draft contains some surprising changes compared to the previous assumptions, the very publication of the next version should be read as a good sign, which may be related to the information published on the website of the Chancellery of the Prime Minister that the planned date of adoption of the draft by the Council of Ministers is Q1 2023.
What obligations and for whom does the Whistleblower Act introduce?
The entry into force of the Act on Whistleblowers will apply to any legal entity for which at least 50 people perform or provide work (except for entities enumerated in the Act, mainly from regulated industries, such as the financial market, and except for offices and organizational units with fewer than 10,000 inhabitants).
The above means that each entity that employs at least 50 people under an employment contract or other contracts (including civil law contracts, including B2B) will be obliged to apply the Act and implement the resulting obligations.
The primary obligation of an entity subject to the Act is generally to ensure the protection of persons who report violations of the law (so-called whistleblowers) against retaliation.
This obligation is specified in the need to implement an internal procedure for reporting violations of law and taking follow-up actions (internal notification procedure) and the obligation to keep a register of internal notifications.
What is the implementation of the internal reporting procedure?
The procedure of internal notifications is an act of internal law at the employer, established by this employer after consultation with the company trade union organization operating in the legal entity or with representatives of persons providing work for this legal entity.
The Act indicates the minimum, obligatory content of the procedure, which includes, among others:
- an indication of the unit or person designated in a given legal entity to receive reports, handle them, consider them and take follow-up actions;
- a description of the methods of submitting reports by whistleblowers;
- the obligation to confirm the receipt of the notification to the applicant within 7 days of its receipt;
- the maximum time limit for providing feedback to the applicant, not exceeding 3 months from the confirmation of receipt of the notification;
- defining a system of incentives to use the internal reporting procedure.
The implementation of the internal reporting procedure, which is only a description of the process functioning in a given legal entity, should be distinguished from the entire system of accepting and handling whistleblowers and their reports. Such a system must meet a number of requirements, including: functionalities specified in the Act, ensuring the security of data transfer, anonymization and access control to the content of notifications by persons authorized by the legal entity. The system that meets all the requirements provided for in the Act is WeMoral.
In addition to the internal reporting procedure, the act also provides for other obligations of the employer, among which the following can be distinguished:
- the obligation to keep a register of internal notifications
- the obligation to ensure the confidentiality of the whistleblower's data and the data contained in the report
- the obligation to store the data contained in the notification for no longer than 15 months after the end of the year in which the follow-up actions were completed or after the completion of the proceedings initiated by these actions.
- information obligations towards the whistleblower.
How to ensure the efficient functioning of the infringement reporting system?
The functioning of the infringement reporting system consists of several elements, mainly:
- formal element - involving the obligation to develop and implement internal regulations, including the procedure of internal notifications;
- organizational element - consisting in ensuring and implementing a technical and personnel structure that ensures compliance with applicable regulations and enables efficient handling of notifications received from whistleblowers.
The best way to quickly and professionally implement the above. elements is the implementation of the WeMoral system - a comprehensive and anonymous system for handling notifications of violations of the law, which ensures compliance with the new regulations, anonymity of notifications and ease of use.
Catalog of violations
The draft law in art. 3 indicates a catalog of violations of the law that may be reported by a whistleblower. At the same time, it is indicated that this catalog is not closed and a legal entity implementing the internal reporting procedure may decide to extend it to include violations of internal regulations (e.g. policies, regulations applicable in the entity) or ethical standards (e.g. resulting from internal codes of conduct, codes of good practices).
Who can be a person reporting a violation of the law, i.e. whistleblower
A whistleblower is a person who reports or publicly discloses information about a violation of the law obtained in a work-related context. From the point of view of a given entity subject to the Act, a whistleblower may be:
• job applicant
• employee (including temporary)
• trainee, trainee
• contractor or other person providing work under a civil law contract
• entrepreneur (e.g. contractor or B2B employee)
• partner, shareholder
It is worth noting that the catalog defined in this way is also a catalog of categories of persons to whom a given legal entity is obliged to enable them to submit notifications in accordance with the applicable internal notification procedure.
Whistleblower protection
One of the main objectives of the regulation on whistleblowers at the European level and its implementation in the Member States is the desire to protect whistleblowers against retaliation against them as a result of reporting a violation of the law.
It is worth noting, however, that the Act does not grant protection to every whistleblower, but only to those who had reasonable grounds to believe that the information contained in the report is true and constitutes a violation of the law. In a word, the protection is not to be granted to persons who make reports in bad faith.
Moreover, in the latest version of the draft law on whistleblowers from January 2023, the legislator decided to introduce further restrictions / difficulties in obtaining protection. Namely, protection is to be granted only to the reporting party who reports a violation of the law that concerns the public interest. In practice, this means the exclusion of protection for people who report a violation of the law concerning the interests of private entities, natural persons, which may be a significant factor discouraging whistleblowers from reporting violations.
In the event of an external report, the whistleblower may apply to the public authority for a certificate in which the authority confirms that the whistleblower is subject to the protection provided for in the Act. On the other hand, the public authority is obliged to issue an appropriate certificate, but only after substantiating the occurrence of a violation of the law.
What is retaliation?
As mentioned above, one of the main objectives of the new regulations is to protect the whistleblower from retaliation. The Act explicitly prohibits taking retaliatory actions against the reporting person, and even attempts or threats to take such actions.
Moreover, the above protection also extends to persons assisting in the filing of the report, persons related to the applicant, as well as to the organizational unit owned by the applicant or employing him/her.
The Act does not indicate a closed catalog of retaliatory actions, but only examples of retaliation, such as termination or termination of the contract with the applicant, failure to extend the contract with the applicant, reduction of remuneration, suspension of promotion, unfavorable change in working conditions, mobbing, discrimination or unjustified referral for medical examinations.
An important aspect that strengthens the protection of the reporting person is the introduction of the principle that the employer bears the burden of proving that a specific action is not retaliatory.
Follow-up
While, as a result of the whistleblower's report, the employer cannot take any retaliatory action, it is obliged to take follow-up action.
According to the definition contained in the Act, these are actions taken by a legal entity or public authority in order to assess the veracity of the information contained in the report and to counteract the violation of law that is the subject of the report, in particular by means of investigation, initiation of control or administrative proceedings, bringing charges, action taken to recover funds or closure of the internal reporting and follow-up procedure or external reporting and follow-up procedure.
The obligation to take follow-up actions must result from the internal reporting procedure, and the employer is obliged to inform the whistleblower about the taken or planned follow-up actions no later than within 3 months from the date of confirmation of receipt of the report or from the date of making the report (if no confirmation of receipt of the report was made).
Internal and external reporting
The Act provides for 3 modes of disclosure by a whistleblower of a violation of the law covered by the Act:
- internal reporting - made within a given organization in accordance with the internal reporting procedure;
- external notification - a notification submitted directly to the relevant public authority, including: the Police, the National Labor Inspectorate, the prosecutor's office, in accordance with the external reporting procedure adopted in a given authority. What is important, a whistleblower may make an external report without having to make an internal report first.
- Public disclosure - that is, providing information about the violation of the law to the public. A whistleblower wishing to make a public disclosure and be protected under the Act should follow the procedure provided for in Chapter 5 of the Act.
Penal provisions
The Act introduces a number of provisions providing for criminal liability, e.g. behind:
- making it difficult or impossible to report a violation of the law;
- taking retaliatory actions
- disclosure of the whistleblower's identity contrary to the provisions of the Act (in certain situations it is permissible)
- making a report where the reporter knows that a breach has not taken place;
When do the new obligations under the Act apply?
The act is to enter into force 2 months after its publication. Entities subject to the Act will have 2 months from the date of entry into force of the Act to adjust, in particular to adopt the internal reporting procedure. The exception to the above rule will be entities for which 50-249 people perform work - for them, the deadline for implementing the internal notification procedure will expire on December 17, 2023.
Taking into account the schedule of work on the act published on the government website, it should be expected that entities not covered by a longer adjustment period must implement the internal notification procedure in the first half of 2023.
